AuthHound

Cisco VSA · attr 1 · type string

Cisco-AVPair

Cisco-AVPair is a string VSA (vendor 9, attribute 1) that carries Cisco features as "attribute=value" pairs — the vehicle for dACLs, URL redirects, and privilege levels that no standard RADIUS attribute expresses.

Also searched as: cisco-av-pair, Cisco AV-Pair. Defined in Cisco vendor dictionary (vendor 9).

What it means

Rather than mint a new numbered attribute for every feature, Cisco packs them into free-form Cisco-AVPair strings like "shell:priv-lvl=15" or "ip:inacl#1=permit ip any any". Several Cisco-AVPair attributes can appear in one Access-Accept, each carrying a different instruction. Because the payload is an opaque string to everything except Cisco gear, the exact left-hand key has to match what that platform and OS version expects.

How it's used

Return one Cisco-AVPair per instruction. Common forms: "shell:priv-lvl=15" (device admin privilege), "ip:inacl#1=..." (per-user ACL entries), and the ISE posture/redirect pairs. The "#n" suffix sequences multi-line ACLs.

Common gotchas

  • The key syntax is platform- and version-specific. An AV-pair that works on IOS may be ignored on NX-OS or WLC — a silent no-op, not an error.
  • For device administration this rides TACACS+ far more often than RADIUS; make sure you're configuring the right protocol's AV-pairs.

Prove what the server actually returned: the open-source authhound-probe prints every authorization attribute in the Access-Accept and asserts the one you care about — a silently ignored attribute becomes a hard FAIL. 

export AUTHHOUND_RADIUS_SECRET='shared-secret'   # not in argv or shell history
authhound-probe radius test --server radius.corp.com --peap alice --expect-attr Filter-Id=staff

Recipe: assert returned attributes with --expect-vlan / --expect-attr

Related

When a NAS quietly stops honoring an attribute across a fleet, nobody sees it until users complain. AuthHound is building monitoring that tracks the attributes your servers actually return — early access:

No spam, no sharing — one email when it's ready, and you can reply to be removed anytime.